Thank you for your question! Peter_Sero is correct here, there is no corresponding RBAC privilege to the commands you mentioned. The workaround he mentions will be sufficient to run these commands. In my testing, I am using a local user, but you can accomplish this with a domain user should you need to:
cluster-1# isi_visudo
## Sudoers override file.
##
## This file overrides the default configuration for sudo as provided by
## Isilon. The defaults can be found at /etc/mcp/templates/sudoers. Do not
## edit /etc/mcp/templates/sudoers.
##
## To add additional command permissions, enter the appropriate configuration
## lines below. To remove a command provided by default, enter a negation line
## below.
##
## Example:
##
## To prevent admin from running SyncIQ, uncomment the line below:
johnsonka
130 Posts
0
June 12th, 2015 10:00
Hello Chris_S,
Thank you for your question! Peter_Sero is correct here, there is no corresponding RBAC privilege to the commands you mentioned. The workaround he mentions will be sufficient to run these commands. In my testing, I am using a local user, but you can accomplish this with a domain user should you need to:
cluster-1# isi_visudo
## Sudoers override file.
##
## This file overrides the default configuration for sudo as provided by
## Isilon. The defaults can be found at /etc/mcp/templates/sudoers. Do not
## edit /etc/mcp/templates/sudoers.
##
## To add additional command permissions, enter the appropriate configuration
## lines below. To remove a command provided by default, enter a negation line
## below.
##
## Example:
##
## To prevent admin from running SyncIQ, uncomment the line below:
## admin ALL=(ALL) !/usr/bin/isi sync*
##
ktjoh ALL=(ALL) ISI_SUPPORT
~
/etc/mcp/override/sudoers.tmp: 16 lines, 538 characters.
isi_visudo: Warning: Cmnd_Alias `ISI_SUPPORT' referenced but not defined
cluster-1# su ktjoh
cluster-1% isi_hw_status
zsh: permission denied: isi_hw_status
cluster-1% sudo isi_hw_status
We trust you have received the usual lecture from the local System
Administrator. It usually boils down to these three things:
#1) Respect the privacy of others.
#2) Think before you type.
#3) With great power comes great responsibility.
Password:
SerNo: SX200-301113-0027
Config: 400-0034-01
FamCode: X
ChsCode: 2U
GenCode: 00
Product: X200-2U-Single-24GB-4x1GE-5632GB-200GB SSD
Comps: Chassis CPU Motherboard NVRam FlashDrive Disk_Controller Disk_Expander Power_Supplies
Chassis: ISI12V2 (Isilon 12-Bay(V2) Chassis)
Peter_Sero
4 Operator
•
1.2K Posts
1
June 3rd, 2015 03:00
The ISI_SUPPORT command set is only relevant within the sudoers file,
and cannot be linked to any RBAC roles. As there is no corresponding "ISI_PRIV_SUPPORT"
privilege; and one cannot create new RBAC privileges...
Seems you have to stick with the plain sudoers mechanism:
use isi_visudo to add
thisusername ALL=(ALL) NOPASSWD: ISI_SUPPORT
hth
-- Peter